一种改进的智能卡远程用户匿名认证方案

针对Sonwanshi提出的远程用户认证方案存在会话密钥安全性差、不能抵御扮演攻击和离线口令猜测攻击的缺陷,提出了一种改进方案,主要在注册和登录阶段增加了安全性能。在注册阶段,用户口令直接在智能卡内进行相应运算,不再提交给服务器。这不仅降低了服务器对口令存储、维护的开销,而且避免了服务器对用户的攻击,提高了安全性能。在登录阶段,采用随机数的挑战应答方式取代原方案的时间戳方式,消除了时钟不同步导致的认证失败。对原方案、改进方案和其他同类方案进行安全性和效率分析的结果表明,改进方案不仅弥补了原方案的缺陷,而且相对同类方案,降低了时间复杂度,适用于安全需求高、处理能力低的设备。     

An efficient biometrics-based remote user authentication scheme using smart cards

In this paper, we propose an efficient biometric-based remote user authentication scheme using smart cards, in which the computation cost is relatively low compared with other related schemes. The security of the proposed scheme is based on the one-way hash function, biometrics verification and smart card. Moreover, the proposed scheme enables the user to change their passwords freely and provides mutual authentication between the users and the remote server. In addition, many remote authentication schemes use timestamps to resist replay attacks. Therefore, synchronized clock is required between the user and the remote server. In our scheme, it does not require synchronized clocks between two entities because we use random numbers in place of timestamps.     

一种改进的远程用户身份认证方案

物联网的快速发展给人们的生产生活带来了极大的便利,但是如何保证用户的信息安全是物联网发展中必须解决的一个重要问题。为了解决该问题,必须在增加较低计算量的前提下,提出安全性更高的身份认证协议。对Nikooghadam等人提出的保护用户身份的协议进行了分析,并在此基础上提出了一种改进的远程用户身份认证协议。采用BAN逻辑进行验证,也进行了性能比较与计算效率分析,结果表明,提出的协议在增加较低计算量的前提下具有更高的安全性。     

Improving the security of ‘a flexible biometrics remote user authentication scheme’

Recently, Lin–Lai proposed ‘a flexible biometrics remote user authentication scheme,’ which is based on El Gamal's cryptosystem and fingerprint verification, and does not need to maintain verification tables on the server. They claimed that their scheme is secured from attacks and suitable for high security applications; however, we point out that their scheme is vulnerable and can easily be cryptanalyzed. We demonstrate that their scheme performs only unilateral authentication (only client authentication) and there is no mutual authentication between user and remote system, thus their scheme is susceptible to the server spoofing attack. To fill this security gap, we present an improvement which overcomes the weakness of Lin–Lai's scheme. As a result, our improved security patch establishes trust between client and remote system in the form of mutual authentication. Moreover, some standards for biometric-based authentication are also discussed, which should be followed during the development of biometric systems.     

An improved timestamp-based remote user authentication scheme

To protect the remote server from various malicious attacks, many authentication schemes have been proposed. Some schemes have to maintain a password verification table in the remote server for checking the legitimacy of the login users. To overcome potential risks of verification tables, researchers proposed remote user authentication schemes using smartcard, in which the remote server only keeps a secret key for computing the user’s passwords and does not need any verification table for verifying legal user. In 2003 Shen, Lin, and Hwang proposed a timestamp-based password authentication scheme using smartcards in which the remote server does not need to store the passwords or verification table for user authentication. Unfortunately, this scheme is vulnerable to some deadly attacks. In this paper, we analyze few attacks and finally propose an improved timestamp-based remote user authentication scheme. The modified scheme is more efficient and secure than original scheme.     

对Liao等人身份鉴别方案的分析与改进

基于智能卡的身份鉴别是一种双因子鉴别,被广泛应用于鉴别远程用户的身份。2006年,Liao等人提出了一种基于智能卡的身份鉴别方案。在目前身份鉴别研究的基础上,分析指出了Liao等人方案存在的安全漏洞,并对方案作了改进,改进后的方案不仅保持了Liao等人方案的优点,而且极大地增强了系统的高效性、安全性和实用性。     

A more efficient and secure dynamic ID-based remote user authentication scheme

In 2004, Das, Saxena and Gulati proposed a dynamic ID-based remote user authentication scheme. This scheme allows users to change and choose passwords freely, and the server does not maintain any verifier table. It is also secure to against ID-theft, replay attacks and insider attacks and so on. However, research has been done to point that it is completely insecure for its independent of the password. Furthermore, it did not achieve mutual authentication and could not resist impersonate remote server attack. In this paper, an enhanced password authentication scheme which still keeps the merits of the original scheme was presented. Security analysis proved that the improved scheme is more secure and practical.     

An improved bilinear pairing based remote user authentication scheme

Recently Das et al. proposed a novel remote user authentication scheme using bilinear pairings. Chou et al. identified a weakness in Das et al.'s scheme and made an improvement. In this paper, we show that both Das et al.'s and Chou et al.'s schemes are insecure against forgery and replay attacks. We proposed an improved scheme that overcomes the security flaws without affecting the merits of the original scheme.     

An improved remote user authentication scheme with key agreement

In distributed systems, user authentication schemes based on password and smart card are widely used to ensure only authorized access to the protected services. Recently, Chang et al. presented an untraceable dynamic-identity-based user authentication scheme with verifiable-password-update. In this research, we illustrate that Chang et al.’s scheme violates the purpose of dynamic-identity contrary to authors’ claim. We show that once the smart card of an arbitrary user is lost, passwords of all registered users are at risk. Using information from an arbitrary smart card, an adversary can impersonate any user of the system. In addition, its password change phase has loopholes and is misguiding. The scheme has no provision for session key agreement and the smart card lacks any verification mechanism. Then we come-up with an improved remote user authentication scheme with the session key agreement, and show its robustness over related schemes.     

More secure remote user authentication scheme

Recently, Yoon and Yoo proposed a remote user authentication scheme which is an improvement on Lee–Kim–Yoo’s method. However, we find out that Yoon–Yoo’s scheme easily reveals a user’s password and is vulnerable to both masquerading user attack and masquerading server attack. Yoon–Yoo’s scheme is also exposed to stolen verifier attack, because it has to maintain a user database in a remote server. This paper proposes a new remote user authentication scheme that resolves all aforementioned problems, while keeping the merits of Yoon–Yoo’s scheme.     

基于动态ID的远程用户身份认证方案

用户身份认证作为网络安全和信息安全的第一道屏障,有着非常重要的作用.口令与智能卡相结合的认证方式可以克服传统口令认证方式的诸多弊端,能够提高网络和信息系统整体的安全性.对基于动态ID的远程用户身份认证方案进行了分析,指出了该方案在入侵者持有用户智能卡的情况下,即使不知道用户口令也能够伪装成合法用户通过远程系统的身份验证,获取系统的网络资源.提出了一种改进方案,能有效抵御重放攻击、伪造攻击、口令猜测攻击、内部攻击和伪装攻击.     

An efficient anonymous authentication protocol in multiple server communication networks (EAAM)

In a multi-server authentication environment, a user only needs to register once at a central registration place before accessing the different services on the different registered servers. Both, from a user point of view as for the management and maintenance of the infrastructure, these types of environments become more and more popular. Smartcard- or smartphone-based approaches lead to more secure systems because they offer two- or three-factor authentication, based on the strict combination of the user’s password, the user’s biometrics and the possession of the device. In this paper, we propose an efficient anonymous authentication protocol in multiple server communication networks, called the EAAM protocol, which is able to establish user anonymity, mutual authentication, and resistance against known security attacks. The novelty of the proposed scheme is that it does not require a secure channel during the registration between the user and the registration center and is resistant to a curious but honest registration system. These features are established in a highly efficient way with the minimum amount of communication flows between user and server during the establishment of the secret shared key and by using light-weight cryptographic techniques such as Chebyshev chaotic map techniques and symmetric key cryptography. The performance and security of the protocol are analyzed and compared with the latest new proposals in this field.     

一种远程用户身份认证方案的密码分析和改进

通过密码分析学的验证方案证明Yoon等人提出的基于Hwang等其他人所证明的远程用户使用智能卡的方案中存在着多个安全漏洞,仍然是脆弱和不稳定的.同时给出如何改进并避免这些漏洞的方法.     

一种基于Smart Card的远程用户身份验证方案的安全性讨论

身份验证是计算机通信的一个重要方面。由于密码验证协议的简单性,它已经被广泛地用于身份验证。最近,Lee氏等利用Smart Card,提出了一个基于随机数的远程用户验证方案。指出了这个方案并不像其提出者所声称的那样安全,同时提出了两种攻击方法以破解其验证方案。     

An efficient improvement remote user mutual authentication and session key agreement scheme for E-health care systems

The E-health care systems allow patients to gain the health monitoring facility and access medical services remotely. A secure mechanism for mutual authentication and session key agreement is the most important requirements for E-Health Care Systems. Recently, Amin et al.’s proposed a mutual authentication and session key agreement protocol and claimed that their scheme is secure against all possible attacks. In this paper, we show that not only their scheme is vulnerable to privileged-insider attack, replay attack, session key disclosure attack, but also does not provide patient untraceability and backward secrecy. In order to withstand the mentioned security weaknesses, we propose an efficient remote mutual authentication scheme for the systems which are using ECC and Fuzzy Extractor. The proposed scheme not only resists against different security attacks, but it also provides an efficient registration, login, mutual authentication, session key agreement, and password and biometric update phases. During the experimentation, it has been observed that the proposed scheme is secure against various known attacks. Beside, our scheme is robust against privileged-insider attack that it rarely checked in security analysis. The informal analysis will ensure that our scheme provides well security protection against the different security attacks. Furthermore, we analyzed the security of the scheme using AVISPA software and Random Oracle Model. The formal analysis results and performance evaluation vouch that our scheme is also secure and efficient in computation and communication cost.     

基于区块链技术的车联网高效匿名认证方案

针对车联网（IOV）中心化认证效率低和隐私保护差的问题，提出一种基于区块链技术的高效匿名认证方案。该方案基于IOV开放、自组织、快速移动的特点，利用区块链技术防篡改和分布式的特性来完成车辆临时身份的生成和区块链存储。车辆相互通信时，通过触发智能合约实现高效匿名的双向身份认证。实验结果表明，在认证效率上，与传统公钥基础设施（PKI）认证、假名授权身份认证相比，随着验证量的增加，所提方案的匿名身份认证的时延增长较慢，效率较高；在安全性能上，所提方案中存入区块链的临时身份具有不可篡改、不可否认、可追溯等特点。所提方案中，恶意车辆身份可回溯并进行权限控制，并且，公钥密码体制和数字签名技术保证了通信数据的保密性和完整性。     

An enhanced smart card based remote user password authentication scheme

Smart card based password authentication is one of the simplest and efficient authentication mechanisms to ensure secure communication in insecure network environments. Recently, Chen et al. have pointed out the weaknesses of some password authentication schemes and proposed a robust smart card based remote user password authentication scheme to improve the security. As per their claims, their scheme is efficient and can ensure forward secrecy of the session key. However, we find that Chen et al.'s scheme cannot really ensure forward secrecy, and it cannot detect the wrong password in login phase. Besides, the password change phase of Chen et al.'s scheme is unfriendly and inefficient since the user has to communicate with the server to update his/her password. In this paper, we propose a modified smart card based remote user password authentication scheme to overcome the aforementioned weaknesses. The analysis shows that our proposed scheme is user friendly and more secure than other related schemes.     

基于区块链技术的车联网高效匿名认证方案

针对车联网（IOV）中心化认证效率低和隐私保护差的问题,提出一种基于区块链技术的高效匿名认证方案。该方案基于IOV开放、自组织、快速移动的特点,利用区块链技术防篡改和分布式的特性来完成车辆临时身份的生成和区块链存储。车辆相互通信时,通过触发智能合约实现高效匿名的双向身份认证。实验结果表明,在认证效率上,与传统公钥基础设施（PKI）认证、假名授权身份认证相比,随着验证量的增加,所提方案的匿名身份认证的时延增长较慢,效率较高;在安全性能上,所提方案中存入区块链的临时身份具有不可篡改、不可否认、可追溯等特点。所提方案中,恶意车辆身份可回溯并进行权限控制,并且,公钥密码体制和数字签名技术保证了通信数据的保密性和完整性。     

Cryptanalysis and improvement on two efficient remote user authentication scheme using smart cards

In 2002, Chien et al. proposed an efficient remote authentication scheme using smart cards, in which only few hashing operations are required. Later, Ku et al. gave an improved scheme to repair the security pitfalls found in Chien et al.'s scheme. Also Yoon et al. presented an enhancement on Ku et al.'s scheme. In this paper, we show that both Ku et al.'s scheme and Yoon et al.'s scheme are still vulnerable to the guessing attack, forgery attack and denial of service (DoS) attack. In addition, their schemes lack efficiency when users input wrong passwords. To remedy these flaws, this paper proposes an efficient improvement over Ku et al.'s and Yoon et al.'s schemes with more security. The computation cost, security, and efficiency of the improved scheme are embarking for the real application in the resource-limited environment.     

一种改进的基于动态身份远程用户认证方案

基于动态身份远程用户认证可有效防止用户关键信息泄露,保证已认证用户通过授权获取网络服务.针对Wen-Li提出的基于动态身份远程用户认证与密钥协商方案进行安全性分析,指出该方案存在安全缺陷,可能导致泄露用户部分关键信息,进而遭受网络攻击.在保留Wen-Li方案优点的基础上提出一种改进的远程用户认证方案,重新设计了认证过程中的会话密钥和密钥确认消息.与Wen-Li方案相比,改进方案能够抵御中间人攻击以及盗窃智能卡攻击,并增强了方案的前向安全性.